AWS Weekly Roundup: AWS Builder Center at 1 year, Network Scanning in Security Hub, Loom for AWS, and more (July 13, 2026) | Amazon Web Services (opens in new tab)
AWS’s weekly roundup highlights the first anniversary of AWS Builder Center and its expansion into a broader learning and experimentation ecosystem. It also introduces major security, AI, container, database, and developer-tool updates, including internet reachability scanning, Azure support in Security Hub, Hugging Face integration with SageMaker, lower GPU management fees, and Aurora DSQL change data capture. The overall direction is toward more integrated, governed, and accessible cloud development workflows. ## AWS Builder Center Turns One - Launched on July 9, 2025, Builder Center has expanded from a community hub into an ecosystem with: - Sandbox environments - Workshops and the Builders’ Library - Community Spaces, profiles, badges, and streaks - AWS regional capability listings - Saved items, article series, availability notifications, and GitHub/Amazon sign-in - In its first year: - 5,548 authors published 6,448 articles. - Articles received more than 10.4 million page views. - Builders earned 99,226 badges. - The community submitted 565 feature wishes, with 10 already delivered. - The most popular articles covered MCP and Strands Agents, Linux migration with Kiro, and multimodal AI for neurological screening. ## Free AWS Sandbox Environments - Builder Center now offers free, pre-provisioned AWS accounts for workshop exercises. - Each sandbox: - Remains active for eight hours. - Automatically removes the account and resources afterward. - Requires no personal AWS account, credit card, or manual cleanup. - Users can have one active sandbox and request one sandbox per week. ## Security Hub Adds Network and Azure Coverage - Security Hub Network Scanning probes AWS and Azure environments from the public internet. - It identifies: - Public IP addresses, virtual machines, and load balancers. - Reachable ports. - Services operating behind those ports. - Each reachable port produces a finding, which Security Hub Exposures correlates with other configuration and security findings. - Existing customers can enable the feature by account, Region, or organization policy; it is enabled by default for new customers. - Network Scanning is included with Security Hub Essentials at no extra cost. - Security Hub also now evaluates Azure VMs, container images, Function Apps, and identities for vulnerabilities, misconfigurations, and internet exposure. ## SageMaker Studio and Hugging Face Integration - Users can deploy or customize supported Hugging Face models in SageMaker Studio with one click. - New customers receive automatically configured Studio environments for: - Fine-tuning and reinforcement learning with custom reward functions. - Model evaluation. - Deployment to SageMaker or Bedrock endpoints. - Verified customers receive default GPU access to G5, G6, and G4dn instances, while quota usage is visible in Studio. ## Lower GPU Management Fees - Starting July 1, 2026, EKS Auto Mode and ECS Managed Instances reduced accelerated-instance management fees: - G-series: 35% reduction. - P-series and Trainium: 60% reduction. - Existing customers receive the reductions automatically. - EKS adds accelerator-aware node repair and parallel image pulling. - ECS provides GPU metrics through CloudWatch Container Insights and monitors GPU hardware health. ## Aurora DSQL Change Data Capture - Aurora DSQL CDC is generally available and streams insert, update, and delete events to Kinesis Data Streams. - The events can synchronize microservices, invoke Lambda functions, or feed S3, Redshift, and OpenSearch through Firehose. - CDC is designed to avoid database performance impact and requires no infrastructure management. ## Tools for Governed AI Agents - Loom for AWS is an open-source platform for deploying and managing Strands Agents on Bedrock AgentCore Runtime. - It includes: - Identity-provider integration and RBAC/ABAC. - Lifecycle management for agents, memory, MCP servers, and agent-to-agent connections. - Automated tagging for cost attribution. - Agent Registry integration and human approval for sensitive actions. - The Claude apps gateway provides centralized access, policy, and spending controls for Claude Code and Claude Desktop. - It supports OIDC identity providers, per-user and per-group spending caps, managed request settings, and routing through Amazon Bedrock or Claude Platform on AWS. - AWS MCP Server now supports browser-based OAuth using AWS Console or CLI credentials, including IAM federation and IAM Identity Center, with short-lived tokens and automatic refresh. AWS’s updates favor managed services that reduce operational work while strengthening security and governance. Teams should evaluate Builder Center sandboxes for training, enable Security Hub’s broader scanning where appropriate, and consider the new AI-agent controls and managed GPU options for production workloads.